AuthenticationError.NOT_ADS_USER - Java SDK setServiceAccountUser missing?

[John Reynolds]

I'm having issues getting a Service Account to access our MCC account. I have followed all of the setup steps in the guide, here:

https://developers.google.com/adwords/api/docs/guides/authentication#oauth2_service_accounts

I have the app created in the Dev Console and have placed the JSON in my project directory. The scope is authorized in the G Suite console. I am using this code to generate the credential:

Credential oAuth2Credential = new OfflineCredentials.Builder()
        .forApi(OfflineCredentials.Api.ADWORDS)
        .fromFile()
        .build()
        .generateCredential();

This works and I am returned an Access Token.

What I believe the issue to be, and I'm racking my brain attempting to find anything in the docs or source code for the Java client, is the specification of the ServiceAccountUser to impersonate.

Can anybody provide assistance on that specification? I'm assuming this is where the breakdown is that is causing the AuthenticationError.NOT_ADS_USER to arise.

I see that the Ruby SDK supports a property for "oauth2_prn" in the YAML file, but I don't see any specifications in the Java SDK as to how to do something similar.

Please help.  :)

Thanks!

John

[Peter Oliquino]

Hi John, 

Could you provide the following details? 

• Do you have a Google Apps Domain? To use service accounts with AdWords, a Google Apps Domain is required (as mentioned on the wiki page for service accounts).
• Have you been granted access to the G Suite (former Google Apps) account that you have? 

Depending on the library you use, impersonation can be configured differently. If you are working with a single user I suggest using installed application. With installed application flow you need to authorize each Google account individually. So, you'd need to have each of these users go through the authorization flow and then manage a separate access/refresh token per email address. The authorization step (browser step) for installed application is needed only once and can be done outside of your production environment. All you need is the refresh token which can be cached and deployed with your app. Please see this document for more information on setting up authentication. 

Best regards,

Peter 

AdWords API Team.

[John Reynolds]

FYI - I ended up getting that working.

Yes, I followed all of the steps to create the service account and authorize it for our Google Apps Domain. That isn't the issue.

All of the sample code and examples for using the Service Account fail to show where or how to set the ServiceAccountUser on the GoogleCredential returned from OfflineCredentials Builder.

Simply specifying the location of the JSON file in the ads.properties file only gets you so far. You can receive an accessToken on the GoogleCredential created with the OfflineCredentials Builder, but I could not set the serviceAccountUser as that appears to be required at build time. It would be ideal to have a property for this user in the ads.properties file, or allow for setting this in the OfflineCredentials Builder object.

You are correct that there are a lot of ways to configure impersonation and I managed to dig into the code and replicate my own builder that pulled from the ServiceAccount JSON file and allows for specifying the ServiceAccount user, but I'm not sure why OfflineCredentials and the Adwords Java library doesn't support this. Again, it looks like some of the other SDKs do support specifying the service account user in a property. (e.g. Ruby's YAML "ouath2_prn")

Something like this would be a great addition to the next release of the Java SDK.

Credential oAuth2Credential = new OfflineCredentials.Builder()
        .forApi(OfflineCredentials.Api.ADWORDS)
        .fromFile()

        .withServiceAccountUser("us...@domain.com")
        .build()
        .generateCredential();

Thanks for the reply!

John

[Peter Oliquino]

Hi John,

My apologies for the difficulty you experienced in setting up your service account using the Java library. I could see that you have already gotten in touch (here) with the Java library owners and I'm glad that you have found the solution and is now able to continue with your work. 

Regarding your suggestion - and thank you by the way, I will be discussing this with the team, however, I cannot guarantee if or when this can be available in any of the next releases.

Thanks and regards,

Peter

AdWords API Team